How to completely disable cache for Recursor.

[xzizka]

Hello,

I installed recursor 5.4.2. I use it in cooperation with PDNS Authoritative Server. I set the configuration to completely disable caches at Resolver.

root@abc39554:~ # cat /etc/powerdns/recursor.conf
dnssec:
  validation: off

recursor:
  forward_zones:
    - zone: "ist.nprod.example.com"
      forwarders:
        - 127.0.0.1:5300
    - zone: "discovery-nprod.example.com"
      forwarders:
        - 127.0.0.1:5300

  forward_zones_recurse:
    - zone: "."
      forwarders:
        - 10.6.1.5
        - 10.6.1.9

recordcache:
  max_negative_ttl: 0
  max_entries: 0

incoming:
  listen:
    - 0.0.0.0
  allow_from:
    - 0.0.0.0/0

packetcache:
  disable: true
  ttl: 0

But I still see, that records are beeing cached.

root@abc39554:~ # rec_control get-all | grep -i cache
aggressive-nsec-cache-entries   0
aggressive-nsec-cache-nsec-hits 0
aggressive-nsec-cache-nsec-wc-hits      0
aggressive-nsec-cache-nsec3-hits        0
aggressive-nsec-cache-nsec3-wc-hits     0
cache-entries   27
cache-hits      26
cache-misses    44
max-cache-entries       0
max-packetcache-entries 0
negcache-entries        0
packetcache-acquired    0
packetcache-contended   0
packetcache-entries     0
packetcache-hits        0
packetcache-misses      0
record-cache-acquired   121086
record-cache-contended  0
root@abc39554:~ #

My recursor version is 5.4.2:

root@abc39554:~ # rec_control version
5.4.2
root@abc39554:~ #

Is there a way how to prevent recursor to cache any record, or is it a bug?
Thank you.

[lMysticl]

This is expected in 5.4.2; it does not mean that packetcache.disable failed. Your packet-cache counters confirm that the packet cache is disabled.

recordcache.max_entries: 0 is a pruning target, not a switch that prevents records from being inserted. The record cache is pruned to the configured limit every five seconds, while normal resolution can add entries between those runs. Therefore, cache-entries can remain temporarily non-zero under traffic, and cache-hits is cumulative.

There is no equivalent disable option for the record cache. recordcache.max_ttl also has a minimum of 15 seconds. If the goal is to see authoritative changes immediately, use low or zero TTLs on the authoritative side, or explicitly wipe the affected names with rec_control.

References: 5.4.2 pruning loop, record-cache settings.

[omoerbeek]

To give a bit of background information in addition to the post above: the record cache is needed to fully resolve names, as often intermediate targets need to be resolved, for example root hints, name servers name to IP mappings or intermediate CNAME chain results. These intermediate results are stored into the record cache, so they can be used during the resolving process. The final result is cached as well. If you are using rec as a pure forwarder (as the posted config shows, rec wil still cache results to avoid hammering the forwarding targets too much.

If you do not want this (but explain why not?), maybe dnsdist is a better tool to achieve what you want.